Repository Public
1---2title: Issuers3url: https://platform.claude.com/docs/en/api/beta/organization/federation/issuers4---56# Issuers78## Create Federation Issuer910**POST** `/v1/organizations/federation_issuers`1112**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).1314Register an OIDC issuer that Anthropic will trust for workload identity15federation in your organization.1617The `jwks` field controls how the issuer's signing keys are obtained and18takes one of three shapes selected by `type`: `discovery` (resolve keys19through OIDC discovery), `explicit_url` (fetch keys from a fixed JWKS20URL), or `inline` (provide a static key set). When `jwks.type` is21`discovery` and no `discovery_base` is set, the issuer URL must be22publicly reachable over HTTPS so Anthropic can fetch the discovery23document; for `explicit_url` and `inline` modes the issuer URL is only24matched as the JWT's `iss` claim and is not fetched.2526### Headers2728- `"anthropic-beta": optional array of AnthropicBeta`2930 Optional header to specify the beta version(s) you want to use.3132 - `string`3334 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`3536 - `"message-batches-2024-09-24"`3738 - `"prompt-caching-2024-07-31"`3940 - `"computer-use-2024-10-22"`4142 - `"computer-use-2025-01-24"`4344 - `"pdfs-2024-09-25"`4546 - `"token-counting-2024-11-01"`4748 - `"token-efficient-tools-2025-02-19"`4950 - `"output-128k-2025-02-19"`5152 - `"files-api-2025-04-14"`5354 - `"mcp-client-2025-04-04"`5556 - `"mcp-client-2025-11-20"`5758 - `"dev-full-thinking-2025-05-14"`5960 - `"interleaved-thinking-2025-05-14"`6162 - `"code-execution-2025-05-22"`6364 - `"extended-cache-ttl-2025-04-11"`6566 - `"context-1m-2025-08-07"`6768 - `"context-management-2025-06-27"`6970 - `"model-context-window-exceeded-2025-08-26"`7172 - `"skills-2025-10-02"`7374 - `"fast-mode-2026-02-01"`7576 - `"output-300k-2026-03-24"`7778 - `"user-profiles-2026-03-24"`7980 - `"user-profiles-2026-08-18"`8182 - `"user-profiles-2026-09-04"`8384 - `"advisor-tool-2026-03-01"`8586 - `"managed-agents-2026-04-01"`8788 - `"cache-diagnosis-2026-04-07"`8990 - `"dreaming-2026-04-21"`9192 - `"thinking-token-count-2026-05-13"`9394 - `"server-side-fallback-2026-06-01"`9596 - `"server-side-fallback-2026-07-01"`9798 - `"fallback-credit-2026-06-01"`99100 - `"fallback-credit-2026-07-01"`101102 - `"agent-memory-2026-07-22"`103104 - `"mid-conversation-tool-changes-2026-07-01"`105106 - `"compact-2026-01-12"`107108 - `"computer-use-2025-11-24"`109110 - `"mcp-tunnels-2026-06-22"`111112 - `"structured-outputs-2025-11-13"`113114 - `"task-budgets-2026-03-13"`115116 - `"thinking-display-updates-2026-08-18"`117118 - `"ce-user-management-2026-07-13"`119120 - `"mid-conversation-output-config-2026-07-01"`121122 - `"thinking-binding-controls-2026-08-01"`123124 - `"mid-conversation-system-clear-at-2026-08-21"`125126 - `"compact-2026-09-04"`127128### Body parameters129130- `issuer_url: string`131132 The `iss` claim value to match against.133134 minLength: 1135136- `name: string`137138 Slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.139140 maxLength: 255, minLength: 1141142- `check_jti: optional boolean or null`143144 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Defaults to true. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.145146- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`147148 How signing keys are obtained. Defaults to OIDC discovery.149150 - `BetaJWKSDiscovery object`151152 JWKS via the issuer's OIDC discovery document.153154 - `type: "discovery"`155156 - `ca_cert_pem: optional string or null`157158 Optional custom CA (PEM) for TLS verification of the JWKS fetch.159160 maxLength: 8192161162 - `discovery_base: optional string or null`163164 Set when the discovery URL differs from `issuer_url`.165166 - `BetaJWKSExplicitURL object`167168 JWKS fetched from a fixed endpoint.169170 - `type: "explicit_url"`171172 - `url: string`173174 JWKS endpoint.175176 minLength: 1177178 - `ca_cert_pem: optional string or null`179180 Optional custom CA (PEM) for TLS verification of the JWKS fetch.181182 maxLength: 8192183184 - `BetaJWKSInline object`185186 JWKS supplied directly; no network fetch.187188 - `type: "inline"`189190 - `keys: array of map[unknown]`191192 Inline JWK objects.193194 minItems: 1195196- `max_jwt_lifetime_seconds: optional number or null`197198 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Defaults to 3600 (1h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.199200 maximum: 176400, exclusiveMinimum: 0201202### Returns203204- `BetaFederationIssuer object`205206 Registered external OIDC identity provider.207208 Records an external IdP the organization trusts for the RFC 7523209 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.210211 - `type: "federation_issuer"`212213 default: federation_issuer214215 - `id: string`216217 Tagged ID of the federation issuer.218219 - `archived_at: string or null`220221 If set, all rules referencing this issuer reject token exchange.222223 format: date-time224225 - `archived_by_actor_id: string or null`226227 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.228229 - `check_jti: boolean`230231 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.232233 - `created_at: string`234235 When this issuer was created.236237 format: date-time238239 - `created_by_actor_id: string or null`240241 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.242243 - `issuer_url: string`244245 The `iss` claim value. Incoming JWTs must match exactly.246247 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`248249 How signing keys are obtained for signature verification.250251 - `BetaJWKSDiscovery object`252253 JWKS via the issuer's OIDC discovery document.254255 - `type: "discovery"`256257 - `ca_cert_pem: optional string or null`258259 Optional custom CA (PEM) for TLS verification of the JWKS fetch.260261 maxLength: 8192262263 - `discovery_base: optional string or null`264265 Set when the discovery URL differs from `issuer_url`.266267 - `BetaJWKSExplicitURL object`268269 JWKS fetched from a fixed endpoint.270271 - `type: "explicit_url"`272273 - `url: string`274275 JWKS endpoint.276277 minLength: 1278279 - `ca_cert_pem: optional string or null`280281 Optional custom CA (PEM) for TLS verification of the JWKS fetch.282283 maxLength: 8192284285 - `BetaJWKSInline object`286287 JWKS supplied directly; no network fetch.288289 - `type: "inline"`290291 - `keys: array of map[unknown]`292293 Inline JWK objects.294295 minItems: 1296297 - `jwks_polling_disabled_at: string or null`298299 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.300301 format: date-time302303 - `max_jwt_lifetime_seconds: number`304305 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.306307 - `name: string`308309 Admin-chosen slug identifier.310311 - `poll_status: BetaFederationIssuerPollStatus or null`312313 Status of automatic JWKS polling for a federation issuer.314315 Anthropic periodically fetches the issuer's signing keys in the316 background. These fields summarize the most recent fetches so the317 health of the JWKS endpoint can be monitored.318319 - `consecutive_failures: number`320321 Consecutive fetch failures since the last success.322323 - `last_fetched_at: string or null`324325 When the last successful fetch completed.326327 format: date-time328329 - `next_poll_at: string or null`330331 When the next fetch is scheduled. Null if paused.332333 format: date-time334335 - `updated_at: string`336337 When this issuer was last updated.338339 format: date-time340341 - `updated_by_actor_id: string or null`342343 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.344345### Example346347```bash348curl https://api.anthropic.com/v1/organizations/federation_issuers \349 -H 'Content-Type: application/json' \350 -H 'anthropic-version: 2023-06-01' \351 -H "X-Api-Key: $ANTHROPIC_API_KEY" \352 -d '{353 "issuer_url": "x",354 "name": "x"355 }'356```357358#### Response (200)359360```json361{362 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",363 "archived_at": "2019-12-27T18:11:19.117Z",364 "archived_by_actor_id": "archived_by_actor_id",365 "check_jti": true,366 "created_at": "2024-10-30T23:58:27.427722Z",367 "created_by_actor_id": "created_by_actor_id",368 "issuer_url": "https://token.actions.githubusercontent.com",369 "jwks": {370 "type": "discovery",371 "ca_cert_pem": "ca_cert_pem",372 "discovery_base": "discovery_base"373 },374 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",375 "max_jwt_lifetime_seconds": 0,376 "name": "github-actions",377 "poll_status": {378 "consecutive_failures": 0,379 "last_fetched_at": "2019-12-27T18:11:19.117Z",380 "next_poll_at": "2019-12-27T18:11:19.117Z"381 },382 "type": "federation_issuer",383 "updated_at": "2024-10-30T23:58:27.427722Z",384 "updated_by_actor_id": "updated_by_actor_id"385}386```387388## List Federation Issuers389390**GET** `/v1/organizations/federation_issuers`391392**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).393394List federation issuers in your organization.395396Archived issuers are excluded unless `include_archived=true`.397398### Query parameters399400- `include_archived: optional boolean`401402 Include archived resources. Defaults to false.403404 default: false405406- `limit: optional number`407408 Number of results per page.409410 default: 20, maximum: 100, minimum: 1411412- `page: optional string`413414 Opaque cursor from a previous response's `next_page`.415416### Headers417418- `"anthropic-beta": optional array of AnthropicBeta`419420 Optional header to specify the beta version(s) you want to use.421422 - `string`423424 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`425426 - `"message-batches-2024-09-24"`427428 - `"prompt-caching-2024-07-31"`429430 - `"computer-use-2024-10-22"`431432 - `"computer-use-2025-01-24"`433434 - `"pdfs-2024-09-25"`435436 - `"token-counting-2024-11-01"`437438 - `"token-efficient-tools-2025-02-19"`439440 - `"output-128k-2025-02-19"`441442 - `"files-api-2025-04-14"`443444 - `"mcp-client-2025-04-04"`445446 - `"mcp-client-2025-11-20"`447448 - `"dev-full-thinking-2025-05-14"`449450 - `"interleaved-thinking-2025-05-14"`451452 - `"code-execution-2025-05-22"`453454 - `"extended-cache-ttl-2025-04-11"`455456 - `"context-1m-2025-08-07"`457458 - `"context-management-2025-06-27"`459460 - `"model-context-window-exceeded-2025-08-26"`461462 - `"skills-2025-10-02"`463464 - `"fast-mode-2026-02-01"`465466 - `"output-300k-2026-03-24"`467468 - `"user-profiles-2026-03-24"`469470 - `"user-profiles-2026-08-18"`471472 - `"user-profiles-2026-09-04"`473474 - `"advisor-tool-2026-03-01"`475476 - `"managed-agents-2026-04-01"`477478 - `"cache-diagnosis-2026-04-07"`479480 - `"dreaming-2026-04-21"`481482 - `"thinking-token-count-2026-05-13"`483484 - `"server-side-fallback-2026-06-01"`485486 - `"server-side-fallback-2026-07-01"`487488 - `"fallback-credit-2026-06-01"`489490 - `"fallback-credit-2026-07-01"`491492 - `"agent-memory-2026-07-22"`493494 - `"mid-conversation-tool-changes-2026-07-01"`495496 - `"compact-2026-01-12"`497498 - `"computer-use-2025-11-24"`499500 - `"mcp-tunnels-2026-06-22"`501502 - `"structured-outputs-2025-11-13"`503504 - `"task-budgets-2026-03-13"`505506 - `"thinking-display-updates-2026-08-18"`507508 - `"ce-user-management-2026-07-13"`509510 - `"mid-conversation-output-config-2026-07-01"`511512 - `"thinking-binding-controls-2026-08-01"`513514 - `"mid-conversation-system-clear-at-2026-08-21"`515516 - `"compact-2026-09-04"`517518### Returns519520- `data: array of BetaFederationIssuer`521522 - `type: "federation_issuer"`523524 default: federation_issuer525526 - `id: string`527528 Tagged ID of the federation issuer.529530 - `archived_at: string or null`531532 If set, all rules referencing this issuer reject token exchange.533534 format: date-time535536 - `archived_by_actor_id: string or null`537538 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.539540 - `check_jti: boolean`541542 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.543544 - `created_at: string`545546 When this issuer was created.547548 format: date-time549550 - `created_by_actor_id: string or null`551552 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.553554 - `issuer_url: string`555556 The `iss` claim value. Incoming JWTs must match exactly.557558 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`559560 How signing keys are obtained for signature verification.561562 - `BetaJWKSDiscovery object`563564 JWKS via the issuer's OIDC discovery document.565566 - `type: "discovery"`567568 - `ca_cert_pem: optional string or null`569570 Optional custom CA (PEM) for TLS verification of the JWKS fetch.571572 maxLength: 8192573574 - `discovery_base: optional string or null`575576 Set when the discovery URL differs from `issuer_url`.577578 - `BetaJWKSExplicitURL object`579580 JWKS fetched from a fixed endpoint.581582 - `type: "explicit_url"`583584 - `url: string`585586 JWKS endpoint.587588 minLength: 1589590 - `ca_cert_pem: optional string or null`591592 Optional custom CA (PEM) for TLS verification of the JWKS fetch.593594 maxLength: 8192595596 - `BetaJWKSInline object`597598 JWKS supplied directly; no network fetch.599600 - `type: "inline"`601602 - `keys: array of map[unknown]`603604 Inline JWK objects.605606 minItems: 1607608 - `jwks_polling_disabled_at: string or null`609610 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.611612 format: date-time613614 - `max_jwt_lifetime_seconds: number`615616 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.617618 - `name: string`619620 Admin-chosen slug identifier.621622 - `poll_status: BetaFederationIssuerPollStatus or null`623624 Status of automatic JWKS polling for a federation issuer.625626 Anthropic periodically fetches the issuer's signing keys in the627 background. These fields summarize the most recent fetches so the628 health of the JWKS endpoint can be monitored.629630 - `consecutive_failures: number`631632 Consecutive fetch failures since the last success.633634 - `last_fetched_at: string or null`635636 When the last successful fetch completed.637638 format: date-time639640 - `next_poll_at: string or null`641642 When the next fetch is scheduled. Null if paused.643644 format: date-time645646 - `updated_at: string`647648 When this issuer was last updated.649650 format: date-time651652 - `updated_by_actor_id: string or null`653654 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.655656- `next_page: string or null`657658 Opaque cursor for the next page, or null if no more results.659660### Example661662```bash663curl https://api.anthropic.com/v1/organizations/federation_issuers \664 -H 'anthropic-version: 2023-06-01' \665 -H "X-Api-Key: $ANTHROPIC_API_KEY"666```667668#### Response (200)669670```json671{672 "data": [673 {674 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",675 "archived_at": "2019-12-27T18:11:19.117Z",676 "archived_by_actor_id": "archived_by_actor_id",677 "check_jti": true,678 "created_at": "2024-10-30T23:58:27.427722Z",679 "created_by_actor_id": "created_by_actor_id",680 "issuer_url": "https://token.actions.githubusercontent.com",681 "jwks": {682 "type": "discovery",683 "ca_cert_pem": "ca_cert_pem",684 "discovery_base": "discovery_base"685 },686 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",687 "max_jwt_lifetime_seconds": 0,688 "name": "github-actions",689 "poll_status": {690 "consecutive_failures": 0,691 "last_fetched_at": "2019-12-27T18:11:19.117Z",692 "next_poll_at": "2019-12-27T18:11:19.117Z"693 },694 "type": "federation_issuer",695 "updated_at": "2024-10-30T23:58:27.427722Z",696 "updated_by_actor_id": "updated_by_actor_id"697 }698 ],699 "next_page": "next_page"700}701```702703## Get Federation Issuer704705**GET** `/v1/organizations/federation_issuers/{federation_issuer_id}`706707**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).708709Retrieve a federation issuer by its ID (`fdis_...`).710711### Path parameters712713- `federation_issuer_id: string`714715 ID of the federation issuer.716717### Headers718719- `"anthropic-beta": optional array of AnthropicBeta`720721 Optional header to specify the beta version(s) you want to use.722723 - `string`724725 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`726727 - `"message-batches-2024-09-24"`728729 - `"prompt-caching-2024-07-31"`730731 - `"computer-use-2024-10-22"`732733 - `"computer-use-2025-01-24"`734735 - `"pdfs-2024-09-25"`736737 - `"token-counting-2024-11-01"`738739 - `"token-efficient-tools-2025-02-19"`740741 - `"output-128k-2025-02-19"`742743 - `"files-api-2025-04-14"`744745 - `"mcp-client-2025-04-04"`746747 - `"mcp-client-2025-11-20"`748749 - `"dev-full-thinking-2025-05-14"`750751 - `"interleaved-thinking-2025-05-14"`752753 - `"code-execution-2025-05-22"`754755 - `"extended-cache-ttl-2025-04-11"`756757 - `"context-1m-2025-08-07"`758759 - `"context-management-2025-06-27"`760761 - `"model-context-window-exceeded-2025-08-26"`762763 - `"skills-2025-10-02"`764765 - `"fast-mode-2026-02-01"`766767 - `"output-300k-2026-03-24"`768769 - `"user-profiles-2026-03-24"`770771 - `"user-profiles-2026-08-18"`772773 - `"user-profiles-2026-09-04"`774775 - `"advisor-tool-2026-03-01"`776777 - `"managed-agents-2026-04-01"`778779 - `"cache-diagnosis-2026-04-07"`780781 - `"dreaming-2026-04-21"`782783 - `"thinking-token-count-2026-05-13"`784785 - `"server-side-fallback-2026-06-01"`786787 - `"server-side-fallback-2026-07-01"`788789 - `"fallback-credit-2026-06-01"`790791 - `"fallback-credit-2026-07-01"`792793 - `"agent-memory-2026-07-22"`794795 - `"mid-conversation-tool-changes-2026-07-01"`796797 - `"compact-2026-01-12"`798799 - `"computer-use-2025-11-24"`800801 - `"mcp-tunnels-2026-06-22"`802803 - `"structured-outputs-2025-11-13"`804805 - `"task-budgets-2026-03-13"`806807 - `"thinking-display-updates-2026-08-18"`808809 - `"ce-user-management-2026-07-13"`810811 - `"mid-conversation-output-config-2026-07-01"`812813 - `"thinking-binding-controls-2026-08-01"`814815 - `"mid-conversation-system-clear-at-2026-08-21"`816817 - `"compact-2026-09-04"`818819### Returns820821- `BetaFederationIssuer object`822823 Registered external OIDC identity provider.824825 Records an external IdP the organization trusts for the RFC 7523826 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.827828 - `type: "federation_issuer"`829830 default: federation_issuer831832 - `id: string`833834 Tagged ID of the federation issuer.835836 - `archived_at: string or null`837838 If set, all rules referencing this issuer reject token exchange.839840 format: date-time841842 - `archived_by_actor_id: string or null`843844 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.845846 - `check_jti: boolean`847848 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.849850 - `created_at: string`851852 When this issuer was created.853854 format: date-time855856 - `created_by_actor_id: string or null`857858 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.859860 - `issuer_url: string`861862 The `iss` claim value. Incoming JWTs must match exactly.863864 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`865866 How signing keys are obtained for signature verification.867868 - `BetaJWKSDiscovery object`869870 JWKS via the issuer's OIDC discovery document.871872 - `type: "discovery"`873874 - `ca_cert_pem: optional string or null`875876 Optional custom CA (PEM) for TLS verification of the JWKS fetch.877878 maxLength: 8192879880 - `discovery_base: optional string or null`881882 Set when the discovery URL differs from `issuer_url`.883884 - `BetaJWKSExplicitURL object`885886 JWKS fetched from a fixed endpoint.887888 - `type: "explicit_url"`889890 - `url: string`891892 JWKS endpoint.893894 minLength: 1895896 - `ca_cert_pem: optional string or null`897898 Optional custom CA (PEM) for TLS verification of the JWKS fetch.899900 maxLength: 8192901902 - `BetaJWKSInline object`903904 JWKS supplied directly; no network fetch.905906 - `type: "inline"`907908 - `keys: array of map[unknown]`909910 Inline JWK objects.911912 minItems: 1913914 - `jwks_polling_disabled_at: string or null`915916 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.917918 format: date-time919920 - `max_jwt_lifetime_seconds: number`921922 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.923924 - `name: string`925926 Admin-chosen slug identifier.927928 - `poll_status: BetaFederationIssuerPollStatus or null`929930 Status of automatic JWKS polling for a federation issuer.931932 Anthropic periodically fetches the issuer's signing keys in the933 background. These fields summarize the most recent fetches so the934 health of the JWKS endpoint can be monitored.935936 - `consecutive_failures: number`937938 Consecutive fetch failures since the last success.939940 - `last_fetched_at: string or null`941942 When the last successful fetch completed.943944 format: date-time945946 - `next_poll_at: string or null`947948 When the next fetch is scheduled. Null if paused.949950 format: date-time951952 - `updated_at: string`953954 When this issuer was last updated.955956 format: date-time957958 - `updated_by_actor_id: string or null`959960 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.961962### Example963964```bash965curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \966 -H 'anthropic-version: 2023-06-01' \967 -H "X-Api-Key: $ANTHROPIC_API_KEY"968```969970#### Response (200)971972```json973{974 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",975 "archived_at": "2019-12-27T18:11:19.117Z",976 "archived_by_actor_id": "archived_by_actor_id",977 "check_jti": true,978 "created_at": "2024-10-30T23:58:27.427722Z",979 "created_by_actor_id": "created_by_actor_id",980 "issuer_url": "https://token.actions.githubusercontent.com",981 "jwks": {982 "type": "discovery",983 "ca_cert_pem": "ca_cert_pem",984 "discovery_base": "discovery_base"985 },986 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",987 "max_jwt_lifetime_seconds": 0,988 "name": "github-actions",989 "poll_status": {990 "consecutive_failures": 0,991 "last_fetched_at": "2019-12-27T18:11:19.117Z",992 "next_poll_at": "2019-12-27T18:11:19.117Z"993 },994 "type": "federation_issuer",995 "updated_at": "2024-10-30T23:58:27.427722Z",996 "updated_by_actor_id": "updated_by_actor_id"997}998```9991000## Update Federation Issuer10011002**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}`10031004**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).10051006Partially update a federation issuer.10071008Setting `jwks` replaces the full JWKS shape at once. Archived issuers1009cannot be updated; this returns 400. Create a new issuer instead.10101011Updating an issuer that backs a rule with a scope outside1012`workspace:developer` or `workspace:inference` requires a Console1013session.10141015### Path parameters10161017- `federation_issuer_id: string`10181019 ID of the federation issuer to update.10201021### Headers10221023- `"anthropic-beta": optional array of AnthropicBeta`10241025 Optional header to specify the beta version(s) you want to use.10261027 - `string`10281029 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`10301031 - `"message-batches-2024-09-24"`10321033 - `"prompt-caching-2024-07-31"`10341035 - `"computer-use-2024-10-22"`10361037 - `"computer-use-2025-01-24"`10381039 - `"pdfs-2024-09-25"`10401041 - `"token-counting-2024-11-01"`10421043 - `"token-efficient-tools-2025-02-19"`10441045 - `"output-128k-2025-02-19"`10461047 - `"files-api-2025-04-14"`10481049 - `"mcp-client-2025-04-04"`10501051 - `"mcp-client-2025-11-20"`10521053 - `"dev-full-thinking-2025-05-14"`10541055 - `"interleaved-thinking-2025-05-14"`10561057 - `"code-execution-2025-05-22"`10581059 - `"extended-cache-ttl-2025-04-11"`10601061 - `"context-1m-2025-08-07"`10621063 - `"context-management-2025-06-27"`10641065 - `"model-context-window-exceeded-2025-08-26"`10661067 - `"skills-2025-10-02"`10681069 - `"fast-mode-2026-02-01"`10701071 - `"output-300k-2026-03-24"`10721073 - `"user-profiles-2026-03-24"`10741075 - `"user-profiles-2026-08-18"`10761077 - `"user-profiles-2026-09-04"`10781079 - `"advisor-tool-2026-03-01"`10801081 - `"managed-agents-2026-04-01"`10821083 - `"cache-diagnosis-2026-04-07"`10841085 - `"dreaming-2026-04-21"`10861087 - `"thinking-token-count-2026-05-13"`10881089 - `"server-side-fallback-2026-06-01"`10901091 - `"server-side-fallback-2026-07-01"`10921093 - `"fallback-credit-2026-06-01"`10941095 - `"fallback-credit-2026-07-01"`10961097 - `"agent-memory-2026-07-22"`10981099 - `"mid-conversation-tool-changes-2026-07-01"`11001101 - `"compact-2026-01-12"`11021103 - `"computer-use-2025-11-24"`11041105 - `"mcp-tunnels-2026-06-22"`11061107 - `"structured-outputs-2025-11-13"`11081109 - `"task-budgets-2026-03-13"`11101111 - `"thinking-display-updates-2026-08-18"`11121113 - `"ce-user-management-2026-07-13"`11141115 - `"mid-conversation-output-config-2026-07-01"`11161117 - `"thinking-binding-controls-2026-08-01"`11181119 - `"mid-conversation-system-clear-at-2026-08-21"`11201121 - `"compact-2026-09-04"`11221123### Body parameters11241125- `check_jti: optional boolean or null`11261127 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.11281129- `issuer_url: optional string or null`11301131 Replaces the `iss` claim value to match against. For discovery-mode issuers without a `discovery_base`, this is also the URL Anthropic fetches the OIDC discovery document and signing keys from, so changing it repoints the JWKS source. Changing the issuer URL to a well-known shared platform is rejected while any live rule under this issuer would not constrain tenant identity.11321133 minLength: 111341135- `jwks: optional BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline or null`11361137 Replaces the entire JWKS configuration.11381139 - `BetaJWKSDiscovery object`11401141 JWKS via the issuer's OIDC discovery document.11421143 - `type: "discovery"`11441145 - `ca_cert_pem: optional string or null`11461147 Optional custom CA (PEM) for TLS verification of the JWKS fetch.11481149 maxLength: 819211501151 - `discovery_base: optional string or null`11521153 Set when the discovery URL differs from `issuer_url`.11541155 - `BetaJWKSExplicitURL object`11561157 JWKS fetched from a fixed endpoint.11581159 - `type: "explicit_url"`11601161 - `url: string`11621163 JWKS endpoint.11641165 minLength: 111661167 - `ca_cert_pem: optional string or null`11681169 Optional custom CA (PEM) for TLS verification of the JWKS fetch.11701171 maxLength: 819211721173 - `BetaJWKSInline object`11741175 JWKS supplied directly; no network fetch.11761177 - `type: "inline"`11781179 - `keys: array of map[unknown]`11801181 Inline JWK objects.11821183 minItems: 111841185- `jwks_polling_disabled: optional boolean or null`11861187 Only `false` is accepted, to re-enable polling after the system pauses it. Polling is paused automatically; sending `true` is rejected.11881189- `max_jwt_lifetime_seconds: optional number or null`11901191 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.11921193 maximum: 176400, exclusiveMinimum: 011941195- `name: optional string or null`11961197 Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.11981199 maxLength: 255, minLength: 112001201### Returns12021203- `BetaFederationIssuer object`12041205 Registered external OIDC identity provider.12061207 Records an external IdP the organization trusts for the RFC 75231208 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.12091210 - `type: "federation_issuer"`12111212 default: federation_issuer12131214 - `id: string`12151216 Tagged ID of the federation issuer.12171218 - `archived_at: string or null`12191220 If set, all rules referencing this issuer reject token exchange.12211222 format: date-time12231224 - `archived_by_actor_id: string or null`12251226 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.12271228 - `check_jti: boolean`12291230 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.12311232 - `created_at: string`12331234 When this issuer was created.12351236 format: date-time12371238 - `created_by_actor_id: string or null`12391240 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.12411242 - `issuer_url: string`12431244 The `iss` claim value. Incoming JWTs must match exactly.12451246 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`12471248 How signing keys are obtained for signature verification.12491250 - `BetaJWKSDiscovery object`12511252 JWKS via the issuer's OIDC discovery document.12531254 - `type: "discovery"`12551256 - `ca_cert_pem: optional string or null`12571258 Optional custom CA (PEM) for TLS verification of the JWKS fetch.12591260 maxLength: 819212611262 - `discovery_base: optional string or null`12631264 Set when the discovery URL differs from `issuer_url`.12651266 - `BetaJWKSExplicitURL object`12671268 JWKS fetched from a fixed endpoint.12691270 - `type: "explicit_url"`12711272 - `url: string`12731274 JWKS endpoint.12751276 minLength: 112771278 - `ca_cert_pem: optional string or null`12791280 Optional custom CA (PEM) for TLS verification of the JWKS fetch.12811282 maxLength: 819212831284 - `BetaJWKSInline object`12851286 JWKS supplied directly; no network fetch.12871288 - `type: "inline"`12891290 - `keys: array of map[unknown]`12911292 Inline JWK objects.12931294 minItems: 112951296 - `jwks_polling_disabled_at: string or null`12971298 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.12991300 format: date-time13011302 - `max_jwt_lifetime_seconds: number`13031304 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.13051306 - `name: string`13071308 Admin-chosen slug identifier.13091310 - `poll_status: BetaFederationIssuerPollStatus or null`13111312 Status of automatic JWKS polling for a federation issuer.13131314 Anthropic periodically fetches the issuer's signing keys in the1315 background. These fields summarize the most recent fetches so the1316 health of the JWKS endpoint can be monitored.13171318 - `consecutive_failures: number`13191320 Consecutive fetch failures since the last success.13211322 - `last_fetched_at: string or null`13231324 When the last successful fetch completed.13251326 format: date-time13271328 - `next_poll_at: string or null`13291330 When the next fetch is scheduled. Null if paused.13311332 format: date-time13331334 - `updated_at: string`13351336 When this issuer was last updated.13371338 format: date-time13391340 - `updated_by_actor_id: string or null`13411342 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.13431344### Example13451346```bash1347curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID \1348 -H 'Content-Type: application/json' \1349 -H 'anthropic-version: 2023-06-01' \1350 -H "X-Api-Key: $ANTHROPIC_API_KEY" \1351 -d '{}'1352```13531354#### Response (200)13551356```json1357{1358 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",1359 "archived_at": "2019-12-27T18:11:19.117Z",1360 "archived_by_actor_id": "archived_by_actor_id",1361 "check_jti": true,1362 "created_at": "2024-10-30T23:58:27.427722Z",1363 "created_by_actor_id": "created_by_actor_id",1364 "issuer_url": "https://token.actions.githubusercontent.com",1365 "jwks": {1366 "type": "discovery",1367 "ca_cert_pem": "ca_cert_pem",1368 "discovery_base": "discovery_base"1369 },1370 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",1371 "max_jwt_lifetime_seconds": 0,1372 "name": "github-actions",1373 "poll_status": {1374 "consecutive_failures": 0,1375 "last_fetched_at": "2019-12-27T18:11:19.117Z",1376 "next_poll_at": "2019-12-27T18:11:19.117Z"1377 },1378 "type": "federation_issuer",1379 "updated_at": "2024-10-30T23:58:27.427722Z",1380 "updated_by_actor_id": "updated_by_actor_id"1381}1382```13831384## Archive Federation Issuer13851386**POST** `/v1/organizations/federation_issuers/{federation_issuer_id}/archive`13871388**Requires an OAuth access token with the `org:admin` scope**, from `ant auth login --scope org:admin` or a workload identity federation rule; Admin API keys are not accepted. See [Manage WIF with the Admin API](/docs/en/manage-claude/wif-admin-api).13891390Archive a federation issuer.13911392Idempotent; re-archiving returns the issuer with its original1393`archived_at`. Rejected with 400 if any live (non-archived) federation1394rule still references the issuer; archive those rules first (a rule's1395issuer cannot be changed), or recreate them against another issuer.13961397### Path parameters13981399- `federation_issuer_id: string`14001401 ID of the federation issuer to archive.14021403### Headers14041405- `"anthropic-beta": optional array of AnthropicBeta`14061407 Optional header to specify the beta version(s) you want to use.14081409 - `string`14101411 - `"message-batches-2024-09-24" or "prompt-caching-2024-07-31" or "computer-use-2024-10-22" or 43 more`14121413 - `"message-batches-2024-09-24"`14141415 - `"prompt-caching-2024-07-31"`14161417 - `"computer-use-2024-10-22"`14181419 - `"computer-use-2025-01-24"`14201421 - `"pdfs-2024-09-25"`14221423 - `"token-counting-2024-11-01"`14241425 - `"token-efficient-tools-2025-02-19"`14261427 - `"output-128k-2025-02-19"`14281429 - `"files-api-2025-04-14"`14301431 - `"mcp-client-2025-04-04"`14321433 - `"mcp-client-2025-11-20"`14341435 - `"dev-full-thinking-2025-05-14"`14361437 - `"interleaved-thinking-2025-05-14"`14381439 - `"code-execution-2025-05-22"`14401441 - `"extended-cache-ttl-2025-04-11"`14421443 - `"context-1m-2025-08-07"`14441445 - `"context-management-2025-06-27"`14461447 - `"model-context-window-exceeded-2025-08-26"`14481449 - `"skills-2025-10-02"`14501451 - `"fast-mode-2026-02-01"`14521453 - `"output-300k-2026-03-24"`14541455 - `"user-profiles-2026-03-24"`14561457 - `"user-profiles-2026-08-18"`14581459 - `"user-profiles-2026-09-04"`14601461 - `"advisor-tool-2026-03-01"`14621463 - `"managed-agents-2026-04-01"`14641465 - `"cache-diagnosis-2026-04-07"`14661467 - `"dreaming-2026-04-21"`14681469 - `"thinking-token-count-2026-05-13"`14701471 - `"server-side-fallback-2026-06-01"`14721473 - `"server-side-fallback-2026-07-01"`14741475 - `"fallback-credit-2026-06-01"`14761477 - `"fallback-credit-2026-07-01"`14781479 - `"agent-memory-2026-07-22"`14801481 - `"mid-conversation-tool-changes-2026-07-01"`14821483 - `"compact-2026-01-12"`14841485 - `"computer-use-2025-11-24"`14861487 - `"mcp-tunnels-2026-06-22"`14881489 - `"structured-outputs-2025-11-13"`14901491 - `"task-budgets-2026-03-13"`14921493 - `"thinking-display-updates-2026-08-18"`14941495 - `"ce-user-management-2026-07-13"`14961497 - `"mid-conversation-output-config-2026-07-01"`14981499 - `"thinking-binding-controls-2026-08-01"`15001501 - `"mid-conversation-system-clear-at-2026-08-21"`15021503 - `"compact-2026-09-04"`15041505### Returns15061507- `BetaFederationIssuer object`15081509 Registered external OIDC identity provider.15101511 Records an external IdP the organization trusts for the RFC 75231512 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.15131514 - `type: "federation_issuer"`15151516 default: federation_issuer15171518 - `id: string`15191520 Tagged ID of the federation issuer.15211522 - `archived_at: string or null`15231524 If set, all rules referencing this issuer reject token exchange.15251526 format: date-time15271528 - `archived_by_actor_id: string or null`15291530 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.15311532 - `check_jti: boolean`15331534 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.15351536 - `created_at: string`15371538 When this issuer was created.15391540 format: date-time15411542 - `created_by_actor_id: string or null`15431544 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.15451546 - `issuer_url: string`15471548 The `iss` claim value. Incoming JWTs must match exactly.15491550 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`15511552 How signing keys are obtained for signature verification.15531554 - `BetaJWKSDiscovery object`15551556 JWKS via the issuer's OIDC discovery document.15571558 - `type: "discovery"`15591560 - `ca_cert_pem: optional string or null`15611562 Optional custom CA (PEM) for TLS verification of the JWKS fetch.15631564 maxLength: 819215651566 - `discovery_base: optional string or null`15671568 Set when the discovery URL differs from `issuer_url`.15691570 - `BetaJWKSExplicitURL object`15711572 JWKS fetched from a fixed endpoint.15731574 - `type: "explicit_url"`15751576 - `url: string`15771578 JWKS endpoint.15791580 minLength: 115811582 - `ca_cert_pem: optional string or null`15831584 Optional custom CA (PEM) for TLS verification of the JWKS fetch.15851586 maxLength: 819215871588 - `BetaJWKSInline object`15891590 JWKS supplied directly; no network fetch.15911592 - `type: "inline"`15931594 - `keys: array of map[unknown]`15951596 Inline JWK objects.15971598 minItems: 115991600 - `jwks_polling_disabled_at: string or null`16011602 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.16031604 format: date-time16051606 - `max_jwt_lifetime_seconds: number`16071608 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.16091610 - `name: string`16111612 Admin-chosen slug identifier.16131614 - `poll_status: BetaFederationIssuerPollStatus or null`16151616 Status of automatic JWKS polling for a federation issuer.16171618 Anthropic periodically fetches the issuer's signing keys in the1619 background. These fields summarize the most recent fetches so the1620 health of the JWKS endpoint can be monitored.16211622 - `consecutive_failures: number`16231624 Consecutive fetch failures since the last success.16251626 - `last_fetched_at: string or null`16271628 When the last successful fetch completed.16291630 format: date-time16311632 - `next_poll_at: string or null`16331634 When the next fetch is scheduled. Null if paused.16351636 format: date-time16371638 - `updated_at: string`16391640 When this issuer was last updated.16411642 format: date-time16431644 - `updated_by_actor_id: string or null`16451646 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.16471648### Example16491650```bash1651curl https://api.anthropic.com/v1/organizations/federation_issuers/$FEDERATION_ISSUER_ID/archive \1652 -X POST \1653 -H 'anthropic-version: 2023-06-01' \1654 -H "X-Api-Key: $ANTHROPIC_API_KEY"1655```16561657#### Response (200)16581659```json1660{1661 "id": "fdis_01SDCCSbTxrXDpWc1phhtcfK",1662 "archived_at": "2019-12-27T18:11:19.117Z",1663 "archived_by_actor_id": "archived_by_actor_id",1664 "check_jti": true,1665 "created_at": "2024-10-30T23:58:27.427722Z",1666 "created_by_actor_id": "created_by_actor_id",1667 "issuer_url": "https://token.actions.githubusercontent.com",1668 "jwks": {1669 "type": "discovery",1670 "ca_cert_pem": "ca_cert_pem",1671 "discovery_base": "discovery_base"1672 },1673 "jwks_polling_disabled_at": "2019-12-27T18:11:19.117Z",1674 "max_jwt_lifetime_seconds": 0,1675 "name": "github-actions",1676 "poll_status": {1677 "consecutive_failures": 0,1678 "last_fetched_at": "2019-12-27T18:11:19.117Z",1679 "next_poll_at": "2019-12-27T18:11:19.117Z"1680 },1681 "type": "federation_issuer",1682 "updated_at": "2024-10-30T23:58:27.427722Z",1683 "updated_by_actor_id": "updated_by_actor_id"1684}1685```16861687## Domain types16881689### Beta Federation Issuer16901691- `BetaFederationIssuer object`16921693 Registered external OIDC identity provider.16941695 Records an external IdP the organization trusts for the RFC 75231696 jwt-bearer grant. The `issuer_url` must match the JWT `iss` claim exactly.16971698 - `type: "federation_issuer"`16991700 default: federation_issuer17011702 - `id: string`17031704 Tagged ID of the federation issuer.17051706 - `archived_at: string or null`17071708 If set, all rules referencing this issuer reject token exchange.17091710 format: date-time17111712 - `archived_by_actor_id: string or null`17131714 Tagged ID (`user_`/`svac_`) of the actor that archived this issuer.17151716 - `check_jti: boolean`17171718 Whether the jwt-bearer exchange enforces JTI single-use (replay protection) for tokens from this issuer. Applies only to assertions carrying a `jti` claim; tokens without one are accepted without single-use enforcement.17191720 - `created_at: string`17211722 When this issuer was created.17231724 format: date-time17251726 - `created_by_actor_id: string or null`17271728 Tagged ID (`user_`/`svac_`) of the actor that created this issuer.17291730 - `issuer_url: string`17311732 The `iss` claim value. Incoming JWTs must match exactly.17331734 - `jwks: BetaJWKSDiscovery or BetaJWKSExplicitURL or BetaJWKSInline`17351736 How signing keys are obtained for signature verification.17371738 - `BetaJWKSDiscovery object`17391740 JWKS via the issuer's OIDC discovery document.17411742 - `type: "discovery"`17431744 - `ca_cert_pem: optional string or null`17451746 Optional custom CA (PEM) for TLS verification of the JWKS fetch.17471748 maxLength: 819217491750 - `discovery_base: optional string or null`17511752 Set when the discovery URL differs from `issuer_url`.17531754 - `BetaJWKSExplicitURL object`17551756 JWKS fetched from a fixed endpoint.17571758 - `type: "explicit_url"`17591760 - `url: string`17611762 JWKS endpoint.17631764 minLength: 117651766 - `ca_cert_pem: optional string or null`17671768 Optional custom CA (PEM) for TLS verification of the JWKS fetch.17691770 maxLength: 819217711772 - `BetaJWKSInline object`17731774 JWKS supplied directly; no network fetch.17751776 - `type: "inline"`17771778 - `keys: array of map[unknown]`17791780 Inline JWK objects.17811782 minItems: 117831784 - `jwks_polling_disabled_at: string or null`17851786 If set, Anthropic's JWKS poller has paused polling for this issuer after repeated fetch failures. Re-enable by sending `jwks_polling_disabled: false` via the issuer update endpoint (POST) once the upstream JWKS endpoint is fixed. An OAuth caller cannot send this when the issuer backs a rule with any scope other than `workspace:developer` or `workspace:inference`; use a Console session.17871788 format: date-time17891790 - `max_jwt_lifetime_seconds: number`17911792 Maximum allowed iat→exp spread for assertions from this issuer (1-176400 seconds, i.e. up to 49h). Assertions must carry both `iat` and `exp`; a missing `iat` is rejected.17931794 - `name: string`17951796 Admin-chosen slug identifier.17971798 - `poll_status: BetaFederationIssuerPollStatus or null`17991800 Status of automatic JWKS polling for a federation issuer.18011802 Anthropic periodically fetches the issuer's signing keys in the1803 background. These fields summarize the most recent fetches so the1804 health of the JWKS endpoint can be monitored.18051806 - `consecutive_failures: number`18071808 Consecutive fetch failures since the last success.18091810 - `last_fetched_at: string or null`18111812 When the last successful fetch completed.18131814 format: date-time18151816 - `next_poll_at: string or null`18171818 When the next fetch is scheduled. Null if paused.18191820 format: date-time18211822 - `updated_at: string`18231824 When this issuer was last updated.18251826 format: date-time18271828 - `updated_by_actor_id: string or null`18291830 Tagged ID (`user_`/`svac_`) of the actor that last updated this issuer.18311832### Beta Federation Issuer Poll Status18331834- `BetaFederationIssuerPollStatus object`18351836 Status of automatic JWKS polling for a federation issuer.18371838 Anthropic periodically fetches the issuer's signing keys in the1839 background. These fields summarize the most recent fetches so the1840 health of the JWKS endpoint can be monitored.18411842 - `consecutive_failures: number`18431844 Consecutive fetch failures since the last success.18451846 - `last_fetched_at: string or null`18471848 When the last successful fetch completed.18491850 format: date-time18511852 - `next_poll_at: string or null`18531854 When the next fetch is scheduled. Null if paused.18551856 format: date-time18571858### Beta JWKS Discovery18591860- `BetaJWKSDiscovery object`18611862 JWKS via the issuer's OIDC discovery document.18631864 - `type: "discovery"`18651866 - `ca_cert_pem: optional string or null`18671868 Optional custom CA (PEM) for TLS verification of the JWKS fetch.18691870 maxLength: 819218711872 - `discovery_base: optional string or null`18731874 Set when the discovery URL differs from `issuer_url`.18751876### Beta JWKS Explicit URL18771878- `BetaJWKSExplicitURL object`18791880 JWKS fetched from a fixed endpoint.18811882 - `type: "explicit_url"`18831884 - `url: string`18851886 JWKS endpoint.18871888 minLength: 118891890 - `ca_cert_pem: optional string or null`18911892 Optional custom CA (PEM) for TLS verification of the JWKS fetch.18931894 maxLength: 819218951896### Beta JWKS Inline18971898- `BetaJWKSInline object`18991900 JWKS supplied directly; no network fetch.19011902 - `type: "inline"`19031904 - `keys: array of map[unknown]`19051906 Inline JWK objects.19071908 minItems: 11909